Choosing how to connect to SAP — the path for each system type (Business Accelerator Hub sandbox, S/4HANA Cloud Public Edition, Private Edition and on-premise through BTP and the Cloud Connector, ECC and RFC), the authentication each supports, and the 2026 restrictions on third-party and AI-agent access
The decision every SAP integration starts with. The Business Accelerator Hub sandbox (API key, test data) is for learning. S/4HANA Cloud Public Edition exposes published APIs through communication arrangements. Private Edition, on-premise and ECC are reached through BTP destinations and the Cloud Connector. node-rfc is deprecated. SAP's April 2026 API policy limits AI agents to SAP-endorsed paths; SAP Note 3255746 blocks third-party ODP over RFC. Includes questions to ask the customer.
markdownreferencev1QENQ-92HHstage: designtrust: officialservice: connectivityinterface: restinterface: odatainterface: rfchow to connect to SAPSAP connection optionsBusiness Accelerator Hub sandbox API keyS/4HANA Cloud Public Edition API accesscommunication arrangementcommunication scenariocommunication systemcommunication userS/4HANA on-premise accessCloud ConnectorBTP destinationprincipal propagationtechnical userOAuth client credentials SAPbasic authentication SAPclient certificate SAPRFC from Node.jsnode-rfc deprecatedSAP Java Connector JCoSAP API policy 2026AI agents SAP API restrictionsSAP Note 3255746ODP RFC third partyquestions to ask SAP customer
Choosing how to connect to SAP
Ask the customer first
- Which system and edition? S/4HANA Cloud Public Edition, Private Edition, on-premise S/4HANA, or ECC, and which release.
- Which business objects and operations? Read or write: business partners, sales orders, products, invoices.
- Is there a published API for them? Check the Business Accelerator Hub (api.sap.com) together with the customer.
- Does the customer run SAP BTP, with a Cloud Connector installed for on-premise systems?
- Who will the calls run as? A technical (communication) user, or the end user through principal propagation.
- Does this integration count as AI-agent access under the customer's SAP contract and SAP's API policy? See the last section.
Paths by system
| System | Path | Authentication | Notes |
|---|---|---|---|
| Business Accelerator Hub sandbox | HTTPS to the sandbox URL shown on each API's Try Out page | An API key in a request header (copy the header name from the hub) | Shared sample data. Good for learning the API shape; no writes that matter, no customer data |
| S/4HANA Cloud Public Edition | HTTPS straight to the tenant's API host, or through a BTP destination of proxy type Internet | What the communication arrangement allows: basic (communication user), OAuth or client certificate | An administrator creates a communication user, a communication system (your app) and a communication arrangement for the API's communication scenario. Only published APIs are exposed. This is the hub's reading of SAP's setup terms; the steps aren't sourced yet |
| S/4HANA Private Edition or on-premise | BTP destination with proxy type OnPremise → connectivity service → Cloud Connector in the customer network → SAP Gateway OData | Basic, client certificate, or principal propagation (the cloud user's identity is passed through) | The Cloud Connector opens an outbound connection only, so no inbound firewall change is needed. It exposes only allowlisted hosts and paths |
| ECC or no OData API | As above, or RFC through the Cloud Connector | RFC needs SAP's connector libraries (JCo for Java) | node-rfc is deprecated ("No longer supported"). Prefer a published OData or SOAP API, or SAP Integration Suite |
| PrivateLink | BTP destination of proxy type PrivateLink | Per service | For selected BTP services reaching your own IaaS accounts |
All BTP destination authentication types are listed in reference/connectivity/btp-destinations-and-cloud-connector.md. Your first call, against the sandbox and then a destination: guides/connectivity/first-call-from-typescript.md.
Restrictions on third-party and AI-agent access (2026)
Reported by several outlets, but the hub couldn't read SAP's own policy text. Check the customer's contract and SAP's published API policy before building.
- SAP API Policy, version 4 (April 2026):
- Third-party AI agents may call SAP APIs only through SAP-endorsed architectures. Reports name Joule, Business Data Cloud and an "Agent Gateway".
- Undocumented or private APIs are banned.
- SAP reserves the right to throttle, suspend or terminate non-compliant access. Integrations on published Business Accelerator Hub APIs are described as compliant.
- SAP Note 3255746: third-party applications using ODP over RFC (a common bulk data-extraction route) are blocked. Vendor articles give June or July 2026 as the date.
The hub's reading:
- Build agents on published APIs called with a named technical user and least-privilege scopes.
- Keep a human approval step for writes.
- Log every call.
- Don't use RFC, ODP or unreleased services for agent access without written agreement from SAP or the customer.